With the introduction of low-cost wireless networking technologies, companies are now more vulnerable to intrusion than ever before. Local area networks (LANs) can become compromised from inside the building by misguided employees installing unauthorized access points, malicious hackers hundreds of yards (up to several miles) away, or ordinary people using the company's resources for free Internet access. The nature and proliferation of wireless networking has opened holes behind corporate and consumer security lines by allowing people to view, without detection, and control network traffic at the lowest layer (layer 2/data link layer).
Wireless network equipment was initially made for consumers and therefore was designed to be cheap and easy to use while security was sacrificed for these features. Given the price point and ease of installation, wireless network's adoption into the corporate environment quickly spread. However, this also made it relatively cheap for anyone, employee or not, to add access points to the LAN. Since these devices are bridges (no routing is involved) restricting users can be difficult. Similarly, their lack of IP addresses makes access points hard to notice from an administrative view.
Another issue exacerbating the problem of wireless networking is that access points are Ethernet devices. The nature of the Ethernet standards, specifically address resolution protocol (ARP), is completely insecure and trusting to all commands. This allows anyone with a connection to an access point to perform man-in-the-middle attacks on anyone else in the same segment, wireless or not.
Adding to the problem of foreign hardware in the corporate environment and the trusting nature of ARP is the fact that as long as the range of both emitting and receiving equipment touch, a connection is made. This results in possible intrusion from miles away.
Organizations that do not use wireless LAN devices are also susceptible to the same dangers. It only takes one (perhaps well meaning) employee to compromise LAN security. For example, that employee might consider having a meeting in another office that does not have LAN connectivity. It then becomes apparent that by bringing their personal wireless access point from home, they could solve this problem. With the connection of that consumer wireless LAN device, the corporate LAN is now available outside of the building. In even worse cases, someone with the intent to harm the organization could hide an unknown wireless access point in the building. This is very feasible, since some access points are no larger than a paperback novel. LANs can become compromised from inside the building by misguided employees installing unauthorized access points, malicious hackers hundreds of yards (up to several miles) away, or ordinary people using the company's resources for free Internet access.
Current strategies to securing the LAN include Wired Equivalent Protection (WEP), multiple Virtual Private Networks (VPNs), or Distributed Name Address Translation (DNAT).
In cases where an organization proactively uses wireless LAN products, encrypting the wireless link presents obstacles. The current method for wireless LAN data security is called WEP, which uses an algorithm called RC4. Recently a group of engineers found a weakness in the RC4 keying algorithm, and published a paper detailing this weakness entitled, “Weaknesses in the Key Scheduling Algorithm of RC4” (Scott Fluhrer, Itsik Mantin, and Adi Shamir, Cisco Systems and The Weizmann Institute, 2001). Since this discovery, several programs have surfaced which allow hackers to take advantage of this security flaw and decrypt WEP frames. Once the key has been obtained, wireless devices often allow access to the wired LAN, which in turn gives an intruder the chance to launch attacks against internal servers, or other sites via the organization's Internet connection.
Because the security built into wireless devices has now been compromised, there is a need to augment wireless LANs with security that is more powerful. One approach is to re-engineer or upgrade WEP so that it accounts for the current security flaws. This will likely require the replacement of 802.11 chipsets currently in use. The cost involved with this plan will be considerable, since both wireless cards and access points will have to be repurchased. Because this solution is accomplished through the use of hardware, another consideration must be the possibility of another security exploit in the new encryption. If there were to be another exploit, it would bring wireless LAN security back to the present condition. Most importantly, however, is the fact that 802.11 security does not address the threat of unauthorized (rogue) access points.
Other approaches involve the use of VPNs. These devices create an encrypted tunnel between themselves and their clients. In the case of a wireless LAN, a properly installed VPN would be installed directly behind a wireless access point. If multiple access points are used in different locations of the LAN, multiple VPNs must be purchased, and placed behind each access point. The common type of VPN installation is much less secure. In most cases, the VPN is installed into the wired LAN without regard to the access point. In this scenario, the VPN acts as a peer to the access point, making its use optional. This means that no VPN authentication is required to access the wired LAN through the wireless access point.
Yet another approach focuses on the use of Distributed Name Address Translation, or DNAT. This method creates a one-to-one association between multiple usable IP addresses and one client-side address. This allows the user to roam throughout the organization, but requires the configuration of another subnet space. This method is more focused on ease-of-use, and authentication appears to be susceptible to common LAN attacks such as man-in-the-middle.
In a network optimally configured for security purposes, the network is divided into trusted and distrusted segments. For example, a locked server room could be considered a trusted segment, while other portions of the LAN could be potentially distrusted. This allows for the placement of gatekeepers physically between the trusted and distrusted segments to ensure that all devices on distrusted segments are authenticated before access is permitted to the trusted segments. This architecture prevents access to the internal LAN, as well as the use of unauthorized or “rogue” access points.
However, in large corporate networks there is widespread implementation of flat network topologies. Flat networks are networks in which every device is connected to switches and there is no limitation on who can connect to the LAN. Networks with flat topologies are devoid of trusted and distrusted physical segments. In such a topology, there is no physical location where an in-line security device can be placed to secure sensitive components, such as data servers and e-mail servers. Organizations that use this form of networking are extremely resistant to change. Placing devices in-line with network traffic is extremely difficult and usually results in resistance from system administrators.
One example of a device for blocking unwanted connections within a larger network is the network connection blocker (NCB) disclosed in U.S. Pat. No. 6,044,402 issued to Jacobson et al. The NCB is a device located proximate to the gateway of a protected subnet in order to passively monitor connections between the subnet and the rest of the network. Unwanted connections are actively blocked by the NCB. In order to block connections, the NCB generates connection packets in accordance with the network protocol suite to cause closure of the detected unwanted connections and transmitting the connection packets to the corresponding host computers within the protected subnet. The NCB operates on the network IP layer (layer 3) in order to monitor and close TCP connections. This allows the NCB to work across subnets. However, by operating on the network IP layer, the NCB is ineffective against data link layer attacks.
The present invention avoids the complexity and cost of these other LAN security approaches, while meeting the needs of flat topology networks.